This was working until we recently upgraded to 7.x-1.0-alpha3. Symptom was that as an anonymous user, it was not possible to view nodes that we otherwise had access to (eg. visiting http://site/node/$nid works fine but http://site/api/node/$uuid.json would return a 403 Permission Denied error).

This appears to be an issue with _uuid_services_entity_access setting $entity to NULL on line 166 unless $arg[2] is set (ie. only if it's part of an update), but then using entity_access($op, $entity_type, $entity); on line 185 which always returns false if a specific entity is not provided:

$ drush ev "var_dump(entity_access('view', 'node', NULL));"
bool(false)
$ drush ev "var_dump(entity_access('view', 'node', current(entity_load('node', array(107)))));"
bool(true)

Fix was to always load the entity when checking access. I'm not intimately familiar with UUID's inner workings so I'm not sure if this has any unforeseen effects elsewhere, but it worked for our use case.

Comments

dixon_’s picture

Assigned: Unassigned » dixon_

I see, good catch. Your logic seems reasonable, but I'm gonna look into this some more and see what's the most solid solution.

dixon_’s picture

Status: Active » Fixed

I've now implemented some improved logic to handle the case mentioned in the OP. It only loads the entity if it's not provided by the request (being an update).

Should work pretty well according to my manual testing. I am going to post an issue about writing simpletests for uuid_services. We need that.

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.

Anonymous’s picture

Issue summary: View changes

Updated to include line numbers